aboutsummaryrefslogtreecommitdiff
path: root/src/event/ngx_event_openssl.h
Commit message (Collapse)AuthorAge
* SSL: fixed testing OPENSSL_VERSION_NUMBER for OpenSSL 3.0+.Sergey Kandaurov7 days
| | | | | | | | | | | | Prior to OpenSSL 3.0, OPENSSL_VERSION_NUMBER used the following format: MNNFFPPS: major minor fix patch status Where the status nibble (S) has 0+ for development and f for release. The format was changed in OpenSSL 3.0.0, where it is always zero: MNN00PP0: major minor patch
* SSL: SSL_group_to_name() compatibility macro.Sergey Kandaurov7 days
| | | | No functional changes.
* QUIC: logging level of handshake errors.Sergey Kandaurov2025-05-23
| | | | | Various errors reported by SSL_do_handshake() are now logged at the "info" or "crit" level, akin to handshakes on regular TCP connections.
* SSL: fixed build with OPENSSL_NO_DH.Sergey Kandaurov2025-04-25
|
* SSL: fixed build with OPENSSL_NO_DEPRECATED.Sergey Kandaurov2025-04-25
|
* SSL: raised limit for sessions stored in shared memory.Sergey Kandaurov2025-02-26
| | | | | | | | | | | | | | Upstream SSL sessions may be of a noticeably larger size with tickets in TLSv1.2 and older versions, or with "stateless" tickets in TLSv1.3, if a client certificate is saved into the session. Further, certain stateless session resumption implemetations may store additional data. Such one is JDK, known to also include server certificates in session ticket data, which roughly doubles a decoded session size to slightly beyond the previous limit. While it's believed to be an issue on the JDK side, this change allows to save such sessions. Another, innocent case is using RSA certificates with 8192 key size.
* SSL: using static storage for NGX_SSL_MAX_SESSION_SIZE buffers.Sergey Kandaurov2025-02-26
| | | | | | All such transient buffers are converted to the single storage in BSS. In preparation to raise the limit.
* Upstream: fixed --with-compat build without SSL, broken by 454ad0e.Pavel Pautov2025-01-23
|
* SSL: avoid using mismatched certificate/key cached pairs.Sergey Kandaurov2025-01-17
| | | | | | | | | | This can happen with certificates and certificate keys specified with variables due to partial cache update in various scenarios: - cache expiration with only one element of pair evicted - on-disk update with non-cacheable encrypted keys - non-atomic on-disk update The fix is to retry with fresh data on X509_R_KEY_VALUES_MISMATCH.
* SSL: caching certificates and certificate keys with variables.Sergey Kandaurov2025-01-17
| | | | | | | | A new directive "ssl_certificate_cache max=N [valid=time] [inactive=time]" enables caching of SSL certificate chain and secret key objects specified by "ssl_certificate" and "ssl_certificate_key" directives with variables. Co-authored-by: Aleksei Bavshin <a.bavshin@nginx.com>
* SSL: a new macro to set default protocol versions.Sergey Kandaurov2024-11-22
| | | | | | | | | This simplifies merging protocol values after ea15896 and ebd18ec. Further, as outlined in ebd18ec18, for libraries preceeding TLSv1.2+ support, only meaningful versions TLSv1 and TLSv1.1 are set by default. While here, fixed indentation.
* SSL: caching CA certificates.Sergey Kandaurov2024-10-01
| | | | | | | This can potentially provide a large amount of savings, because CA certificates can be quite large. Based on previous work by Mini Hawthorne.
* SSL: caching CRLs.Sergey Kandaurov2024-10-01
| | | | Based on previous work by Mini Hawthorne.
* SSL: caching certificate keys.Sergey Kandaurov2024-10-01
| | | | | | | EVP_KEY objects are a reference-counted container for key material, shallow copies and OpenSSL stack management aren't needed as with certificates. Based on previous work by Mini Hawthorne.
* SSL: caching certificates.Sergey Kandaurov2024-10-01
| | | | | | | | | | Certificate chains are now loaded once. The certificate cache provides each chain as a unique stack of reference counted elements. This shallow copy is required because OpenSSL stacks aren't reference counted. Based on previous work by Mini Hawthorne.
* SSL: object caching.Sergey Kandaurov2024-10-01
| | | | | | | | | | Added ngx_openssl_cache_module, which indexes a type-aware object cache. It maps an id to a unique instance, and provides references to it, which are dropped when the cycle's pool is destroyed. The cache will be used in subsequent patches. Based on previous work by Mini Hawthorne.
* SSL: moved certificate storage out of exdata.Sergey Kandaurov2024-10-01
| | | | | | | | Instead of cross-linking the objects using exdata, pointers to configured certificates are now stored in ngx_ssl_t, and OCSP staples are now accessed with rbtree in it. This allows sharing these objects between SSL contexts. Based on previous work by Mini Hawthorne.
* SSL: reasonable version for LibreSSL adjusted.Sergey Kandaurov2023-12-25
| | | | | | | | | | | | OPENSSL_VERSION_NUMBER is now redefined to 0x1010000fL for LibreSSL 3.5.0 and above. Building with older LibreSSL versions, such as 2.8.0, may now produce warnings (see cab37803ebb3) and may require appropriate compiler options to suppress them. Notably, this allows to start using SSL_get0_verified_chain() appeared in OpenSSL 1.1.0 and LibreSSL 3.5.0, without additional macro tests. Prodded by Ilya Shipitsin.
* QUIC: using ngx_ssl_handshake_log().Sergey Kandaurov2023-02-23
|
* Merged with the default branch.Sergey Kandaurov2022-10-20
|\
| * SSL: workaround for session timeout handling with TLSv1.3.Maxim Dounin2022-10-12
| | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL with TLSv1.3 updates the session creation time on session resumption and keeps the session timeout unmodified, making it possible to maintain the session forever, bypassing client certificate expiration and revocation. To make sure session timeouts are actually used, we now update the session creation time and reduce the session timeout accordingly. BoringSSL with TLSv1.3 ignores configured session timeouts and uses a hardcoded timeout instead, 7 days. So we update session timeout to the configured value as soon as a session is created.
| * SSL: optimized rotation of session ticket keys.Maxim Dounin2022-10-12
| | | | | | | | | | | | | | | | | | | | | | | | Instead of syncing keys with shared memory on each ticket operation, the code now does this only when the worker is going to change expiration of the current key, or going to switch to a new key: that is, usually at most once per second. To do so without races, the code maintains 3 keys: current, previous, and next. If a worker will switch to the next key earlier, other workers will still be able to decrypt new tickets, since they will be encrypted with the next key.
| * SSL: automatic rotation of session ticket keys.Maxim Dounin2022-10-12
| | | | | | | | | | | | | | | | | | | | | | | | | | As long as ssl_session_cache in shared memory is configured, session ticket keys are now automatically generated in shared memory, and rotated periodically. This can be beneficial from forward secrecy point of view, and also avoids increased CPU usage after configuration reloads. This also helps BoringSSL to properly resume sessions in configurations with multiple worker processes and no ssl_session_ticket_key directives, as BoringSSL tries to automatically rotate session ticket keys and does this independently in different worker processes, thus breaking session resumption between worker processes.
| * SSL: renamed session ticket key functions and data index.Maxim Dounin2022-10-12
| | | | | | | | Previously used names are way too long, renamed to simplify writing code.
| * SSL: renamed session ticket key type.Maxim Dounin2022-10-12
| | | | | | | | | | The ngx_ssl_session_ticket_key_t is way too long, renamed to ngx_ssl_ticket_key_t to simplify writing code.
| * SSL: style.Maxim Dounin2022-10-12
| | | | | | | | Runtime OCSP functions separated from configuration ones.
| * SSL: single allocation in session cache on 32-bit platforms.Maxim Dounin2022-10-12
| | | | | | | | | | | | | | | | | | | | | | | | Given the present typical SSL session sizes, on 32-bit platforms it is now beneficial to store all data in a single allocation, since rbtree node + session id + ASN1 representation of a session takes 256 bytes of shared memory (36 + 32 + 150 = about 218 bytes plus SNI server name). Storing all data in a single allocation is beneficial for SNI names up to about 40 characters long and makes it possible to store about 4000 sessions in one megabyte (instead of about 3000 sessions now). This also slightly simplifies the code.
| * SSL: reduced logging of session cache failures (ticket #621).Maxim Dounin2022-10-12
| | | | | | | | | | | | | | | | | | | | | | Session cache allocations might fail as long as the new session is different in size from the one least recently used (and freed when the first allocation fails). In particular, it might not be possible to allocate space for sessions with client certificates, since they are noticeably bigger than normal sessions. To ensure such allocation failures won't clutter logs, logging level changed to "warn", and logging is now limited to at most one warning per second.
* | Merged with the default branch.Ruslan Ermilov2021-12-24
|\|
| * SSL: $ssl_curve (ticket #2135).Sergey Kandaurov2021-11-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The variable contains a negotiated curve used for the handshake key exchange process. Known curves are listed by their names, unknown ones are shown in hex. Note that for resumed sessions in TLSv1.2 and older protocols, $ssl_curve contains the curve used during the initial handshake, while in TLSv1.3 it contains the curve used during the session resumption (see the SSL_get_negotiated_group manual page for details). The variable is only meaningful when using OpenSSL 3.0 and above. With older versions the variable is empty.
* | Merged with the default branch.Sergey Kandaurov2021-11-03
|\|
| * SSL: SSL_sendfile() support with kernel TLS.Maxim Dounin2021-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Requires OpenSSL 3.0 compiled with "enable-ktls" option. Further, KTLS needs to be enabled in kernel, and in OpenSSL, either via OpenSSL configuration file or with "ssl_conf_command Options KTLS;" in nginx configuration. On FreeBSD, kernel TLS is available starting with FreeBSD 13.0, and can be enabled with "sysctl kern.ipc.tls.enable=1" and "kldload ktls_ocf" to load a software backend, see man ktls(4) for details. On Linux, kernel TLS is available starting with kernel 4.13 (at least 5.2 is recommended), and needs kernel compiled with CONFIG_TLS=y (with CONFIG_TLS=m, which is used at least on Ubuntu 21.04 by default, the tls module needs to be loaded with "modprobe tls").
| * SSL: added $ssl_alpn_protocol variable.Vladimir Homutov2021-10-14
| | | | | | | | | | The variable contains protocol selected by ALPN during handshake and is empty otherwise.
* | Merged with the default branch.Sergey Kandaurov2021-09-01
|\|
| * SSL: removed export ciphers support.Sergey Kandaurov2021-08-10
| | | | | | | | | | | | Export ciphers are forbidden to negotiate in TLS 1.1 and later protocol modes. They are disabled since OpenSSL 1.0.2g by default unless explicitly configured with "enable-weak-ssl-ciphers", and completely removed in OpenSSL 1.1.0.
| * SSL: silenced warnings when building with OpenSSL 3.0.Sergey Kandaurov2021-08-10
| | | | | | | | | | | | | | | | | | The OPENSSL_SUPPRESS_DEPRECATED macro is used to suppress deprecation warnings. This covers Session Tickets keys, SSL Engine, DH low level API for DHE ciphers. Unlike OPENSSL_API_COMPAT, it works well with OpenSSL built with no-deprecated. In particular, it doesn't unhide various macros in OpenSSL includes, which are meant to be hidden under OPENSSL_NO_DEPRECATED.
| * SSL: ERR_peek_error_line_data() compatibility with OpenSSL 3.0.Sergey Kandaurov2021-08-10
| | | | | | | | | | ERR_peek_error_line_data() was deprecated in favour of ERR_peek_error_all(). Here we use the ERR_peek_error_data() helper to pass only used arguments.
| * SSL: SSL_get_peer_certificate() is deprecated in OpenSSL 3.0.Sergey Kandaurov2021-08-10
| | | | | | | | | | Switch to SSL_get1_peer_certificate() when building with OpenSSL 3.0 and OPENSSL_NO_DEPRECATED defined.
| * SSL: RSA data type is deprecated in OpenSSL 3.0.Sergey Kandaurov2021-08-10
| | | | | | | | | | The only consumer is a callback function for SSL_CTX_set_tmp_rsa_callback() deprecated in OpenSSL 1.1.0. Now the function is conditionally compiled too.
* | Merged with the default branch.Sergey Kandaurov2021-07-15
|\|
| * Fixed SSL logging with lingering close.Maxim Dounin2021-06-01
| | | | | | | | | | | | | | | | | | | | Recent fixes to SSL shutdown with lingering close (554c6ae25ffc, 1.19.5) broke logging of SSL variables. To make sure logging of SSL variables works properly, avoid freeing c->ssl when doing an SSL shutdown before lingering close. Reported by Reinis Rozitis (http://mailman.nginx.org/pipermail/nginx/2021-May/060670.html).
* | QUIC: removed unused <openssl/aes.h> inclusion.Sergey Kandaurov2020-12-22
| | | | | | | | The low-level API was used in early QUIC development.
* | QUIC: fixed build with OpenSSL < 1.1.1.Sergey Kandaurov2020-12-22
| | | | | | | | | | The <openssl/kdf.h> header is available since OpenSSL 1.1.0, and HKDF API used for separate Extract and Expand steps in TLSv1.3 - since OpenSSL 1.1.1.
* | Merged with the default branch.Sergey Kandaurov2020-10-29
|\|
| * SSL: ssl_reject_handshake directive (ticket #195).Maxim Dounin2020-10-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In some cases it might be needed to reject SSL handshake based on SNI server name provided, for example, to make sure an invalid certificate is not returned to clients trying to contact a name-based virtual server without SSL configured. Previously, a "ssl_ciphers aNULL;" was used for this. This workaround, however, is not compatible with TLSv1.3, in particular, when using BoringSSL, where it is not possible to configure TLSv1.3 ciphers at all. With this change, the ssl_reject_handshake directive is introduced, which instructs nginx to reject SSL handshakes with an "unrecognized_name" alert in a particular server block. For example, to reject handshake with names other than example.com, one can use the following configuration: server { listen 443 ssl; ssl_reject_handshake on; } server { listen 443 ssl; server_name example.com; ssl_certificate example.com.crt; ssl_certificate_key example.com.key; } The following configuration can be used to reject all SSL handshakes without SNI server name provided: server { listen 443 ssl; ssl_reject_handshake on; } server { listen 443 ssl; server_name ~^; ssl_certificate example.crt; ssl_certificate_key example.key; } Additionally, the ssl_reject_handshake directive makes configuring certificates for the default server block optional. If no certificates are configured in the default server for a given listening socket, certificates must be defined in all non-default server blocks with the listening socket in question.
| * SSL: ssl_conf_command directive.Maxim Dounin2020-10-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With the ssl_conf_command directive it is now possible to set arbitrary OpenSSL configuration parameters as long as nginx is compiled with OpenSSL 1.0.2 or later. Full list of available configuration commands can be found in the SSL_CONF_cmd manual page (https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html). In particular, this allows configuring PrioritizeChaCha option (ticket #1445): ssl_conf_command Options PrioritizeChaCha; It can be also used to configure TLSv1.3 ciphers in OpenSSL, which fails to configure them via the SSL_CTX_set_cipher_list() interface (ticket #1529): ssl_conf_command Ciphersuites TLS_CHACHA20_POLY1305_SHA256; Configuration commands are applied after nginx own configuration for SSL, so they can be used to override anything set by nginx. Note though that configuring OpenSSL directly with ssl_conf_command might result in a behaviour nginx does not expect, and should be done with care.
* | QUIC: reverted previous 3 commits.Vladimir Homutov2020-10-19
| | | | | | | | Changes were intended for the test repository.
* | SSL: added the "ssl_keys_file" directive.Vladimir Homutov2020-09-15
| |
* | Merged with the default branch.Sergey Kandaurov2020-05-26
|\|
| * OCSP: certificate status cache.Roman Arutyunyan2020-05-22
| | | | | | | | | | | | | | When enabled, certificate status is stored in cache and is used to validate the certificate in future requests. New directive ssl_ocsp_cache is added to configure the cache.
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-17 16:52:03 +0000